Malwarecritical
EnemyBot malware adds new exploits to target CMS servers and Android devices
- CVEs
- CVE-2020-17456CVE-2018-10823CVE-2022-27226CVE-2022-25075CVE-2021-44228CVE-2021-41773CVE-2021-42013CVE-2018-20062CVE-2017-18368CVE-2016-6277CVE-2015-2051CVE-2014-9118CVE-2021-45046CVE-2022-1388CVE-2020-7961CVE-2021-4039CVE-2022-22947CVE-2022-22954CVE-2021-36356CVE-2021-35064CVE-2018-16763CVE-2020-5902
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-2051 | Remote Command Execution via HNAP GetDeviceSettings in D-Link DIR-645 Router | — | 97% | KEV | — KEV |
| CVE-2016-6277 | Unauthenticated RCE via Command Injection in NETGEAR Multiple Routers | 8.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2017-18368 | Unauthenticated OS Command Injection in Zyxel/Billion TrueOnline Routers | 9.8 | 95% | KEVPoC ×3 | KEV |
| CVE-2018-10823 | An issue was discovered on D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111… | 8.8 | 78% | PoC ×2 | |
| CVE-2018-16763 | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter | 9.8 | 83% | PoC ×5 | |
| CVE-2018-20062 | Unauthenticated Remote Code Execution in ThinkPHP-based noneCms 1.3 | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2020-17456 | SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page | 9.8 | 74% | PoC ×2 | |
| CVE-2020-5902 | Unauthenticated RCE via path traversal in F5 BIG-IP TMUI | 9.8 | 100% | KEVRansomwarePoC ×8 | KEV |
| CVE-2020-7961 | Deserialization RCE in Liferay Portal via JSON Web Services | 9.8 | 100% | KEVPoC | KEV |
| CVE-2021-35064 | KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo | 9.8 | 71% | PoC ×2 | |
| CVE-2021-36356 | KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable… | 9.8 | 54% | PoC | |
| CVE-2021-4039 | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device | 9.8 | 71% | PoC | |
| CVE-2021-41773 | Path Traversal to RCE in Apache HTTP Server 2.4.49 | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
| CVE-2021-42013 | Path Traversal and RCE in Apache HTTP Server (follow-up to CVE-2021-41773) | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) | 10.0 | 100% | KEVRansomwarePoC ×9 | KEV |
| CVE-2021-45046 | Remote Code Execution in Apache Log4j2 via Incomplete Log4Shell Fix | 9.0 | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-1388 | Unauthenticated RCE in F5 BIG-IP via Missing Authentication | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
| CVE-2022-22947 | Unauthenticated RCE in VMware Spring Cloud Gateway | 10.0 | 98% | KEVPoC ×2 | KEV |
| CVE-2022-22954 | Server-Side Template Injection RCE in VMware Workspace ONE Access and Identity Manager | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-25075 | TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function | 9.8 | 56% | PoC | |
| CVE-2022-27226 | A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel | 8.8 | 34% | PoC ×3 |
From the original article
4 min read at securityaffairs.com
The operators of the EnemyBot botnet added exploits for recently disclosed flaws in VMware, F5 BIG-IP, and Android systems. Operators behind the EnemyBot botnet are expanding the list of potential targets adding exploits for recently disclosed critical vulnerabilities in from VMware, F5 BIG-IP, and Android.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.